By Rishi Baviskar, Global Head of Cyber Risk Consulting at Allianz Commercial
Improvements in cyber security and business continuity are helping to combat encryption-based ransomware attacks, yet the cyber threat landscape is continually evolving. 2023 has seen a worrying resurgence in ransomware and extortion claims, resulting in an uptick in costly incidents, demonstrating that although progress is being made, the threat posed by ransomware shows little sign of abating.
Reports note that the number of ransomware victims surged by as much as 143% globally during the first quarter of 2023 with January and February seeing the highest number of hack and leak cases in three years. Ransomware alone is projected to cost its victims approximately US$265bn annually by 2031.
Protecting an organization against intrusion remains a cat and mouse game, in which the cyber criminals have the advantage. Threat actors are now exploring ways to use artificial intelligence (AI) to automate and accelerate attacks, creating more effective AI-powered malware and phishing. Combined with the explosion in connected mobile devices and 5G-enabled Internet of Things, the avenues for cyber-attacks look only likely to increase in the coming years.
As a global insurer, Allianz Commercial monitors the emerging threat landscape and assists its clients with mitigating these risks. Here are three key cyber threats currently on our radar:
- Artificial Intelligence
Artificial intelligence (AI) is widely expectedto power futureransomware attacks, with automated attack processes, more convincing phishing, and faster malware development. However, it could also enhance cyber security, with more effective and faster detection and threat intelligence.
Threat actors are already using AI-powered language models like ChatGPT to write code. Generative AI can help less technically proficient threat actors write their own code or create new strains and variations of existing ransomware, potentially increasing the number of attacks they can execute. We can expect an increased utilization of AI by malicious actors in the future, necessitating even stronger cyber security measures.
Voice simulation software has been a recent addition to the cyber criminal’s arsenal. In 2019, the CRO of a British energy provider transferred €220,000 to a scammer after they received a call from what sounded like the head of the unit’s parent company, asking them to wire money to a supplier. The voice was generated using AI. In August 2023, researchers at the Google-owned cybersecurity company Mandiant documented the first known instances of deepfake video technology designed and sold for phishing scams. The going rate was as little as US $20 per minute, US $250 for a full video or US $200 for a training session, although the researchers were unable to confirm that the services they identified on hacker forums were legitimate or whether a deepfake has been used in any scam.
AI will help threat actors, but it is also a powerful tool for detection. We might see more AI-enabled incidents in the future, but investment in detection backed by AI should catch more incidents early. If we can keep pace with developments in AI, there is always the chance it might not change the picture too much from today, neither in favor of the company nor the attacker.
- Mobile Devices
Lax security and the mixing of personal and corporate data on mobile devices, including smartphones, tablets and laptops, is making for an attractive target for cyber criminals. Allianz Commercial has seen a growing number of incidents caused by poor cyber security around mobile devices. During the pandemic many organizations enabled new ways of accessing their corporate network via private devices, without the need for multi-factor authentication (MFA). This also resulted in a number of successful cyberattacks and large claims.
Cyber criminals are now targeting mobile devices with specific malware in order to gain remote access, steal login credentials, or to deploy ransomware. Increasingly we have corporate and personal information on the same device, and threat actors now see this as a potential vulnerability. Personal devices, in particular, tend to have less stringent security measures. Utilizing public wi-fi on these devices can increase their vulnerability, including exposure to phishing attacks via social media.
The roll out of 5G technology is also an area of potential concern. 5G will power more connected devices, including more sophisticated applications, such as driverless or assisted vehicles and smart cities. However, IoT devices do not have a good track record when it comes to cyber security. Many IoT devices are not inherently secure, while the sheer number of these devices globally and the addition of AI could result in a very serious cyber threat. Many of these devices are easily discoverable and will not have MFA mechanisms. Even today we see devices with default passwords that are available on the internet.
- Skill Shortage
A growing shortage of cyber security professionals will increasingly complicate cyber security efforts, potentially increasing the chances of successful attacks in the future. The current global cyber security workforce gap stands at 3.4 million people, according to the ISC2, a non-profit member organization for cyber security professionals, with demand for cyber professionals growing twice as fast as supply. Some 70% of organizations say they do not have enough cyber security staff to be effective. Gartner predicts that a lack of talent or human failure will be responsible for over half of significant cyber incidents by 2025.
There is a crisis in technical skills for cyber security. Because technology is moving so fast, there are not enough experienced people to keep pace with the threats. It’s very hard to get good cyber security engineers, which means companies are more exposed to cyber events. Without skilled cyber security people, it is harder to predict and prevent incidents, which could mean more losses in the future. The shortage of cyber security experts also impacts the cost of responding to a cyber incident. According to the IBM Cost of a Data Breach Report 2023, organizations with a high level of security skills shortage had a US$5.36mn average data breach cost, around 20% higher than the average cost.
Preventing a cyberattack is becoming harder, and the stakes higher. As a result, early detection and response capabilities are becoming ever more important. An intrusion can quickly escalate, and once data is encrypted and / or stolen, the consequences and costs snowball – costs can be as much as, or even more than, 1,000 times higher than if an incident is not detected and contained early, Allianz analysis shows. Ultimately, early detection and effective response capabilities will be key to mitigating the impact of cyberattacks and ensuring a sustainable insurance market going forward.
About the Author
Rishi Baviskar is Global Cyber Experts Leader, Risk Consulting at Allianz Global Corporate & Specialty. Baviskar has experience working within the IT field for large oil, gas, automotive and pharmaceutical companies. In his previous roles, he has worked across all levels of process development, ranging from onsite engineer to the design and implementation of cyber security policies.
Rishi can be reached online at [email protected] and at our company website www.agcs.allianz.com.
